Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators

LevelBlue THOR analysts detail active exploitation of CVE-2026-88771 against Citrix NetScaler appliances: attackers inject shell commands via authentication fields to retrieve and execute second-stage payloads (Python reverse shell and Perl post-exploitation script), create a privileged account (sec_monitor), deploy a PHP web shell, change system binaries and permissions, and attempt to exfiltrate /flash/nsconfig configuration data; the report provides IOCs (IPs, URLs, hashes, file paths) and behavioral detection opportunities for defenders.